Who is responsible for approving and distributing OEM BIOS updates through Windows Update (HP BIOS / Windows IoT Enterprise)?

mitsuki 0 Reputation points
2026-08-06T01:49:17.7866667+00:00

I would like to understand Microsoft's role in the distribution of OEM BIOS updates through Windows Update.

HP has published the following advisory regarding a known issue:

https://support.hp.com/us-en/document/ish_14914515-14914500-16

According to HP, after a BIOS update delivered through Windows Update, some HP business computers enter a BitLocker recovery loop.

My questions are:

  1. Who is responsible for approving, publishing, and withdrawing OEM BIOS updates that are delivered through Windows Update?
    • Microsoft
    • The OEM (HP)
    • Both
  2. If an OEM BIOS update is known to cause a critical issue, such as a BitLocker recovery loop, who is responsible for stopping further distribution through Windows Update?
  3. Windows IoT Enterprise devices appear to have received this BIOS update after the issue had already been identified on standard Windows editions. Is the distribution schedule for Windows IoT Enterprise controlled by Microsoft or by the OEM?

I am not requesting technical support for a specific device. I would simply like to understand the responsibility and distribution process for OEM BIOS updates delivered through Windows Update.

Windows for business | Windows Client for IT Pros | Devices and deployment | Install Windows updates, features, or roles
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Harry Phan 30,640 Reputation points Independent Advisor
    2026-08-18T09:33:38.8+00:00

    Hello,

    The distribution of OEM BIOS updates through Windows Update is a joint process between Microsoft and the OEM, but the responsibilities are clearly divided. The OEM, in this case HP, is the entity that develops, signs, and submits the BIOS update package. Microsoft does not author BIOS updates; instead, it provides the Windows Update infrastructure and validation pipeline to deliver them.

    When an OEM submits a BIOS update, Microsoft performs compatibility and security checks before publishing it to Windows Update. However, the OEM retains responsibility for the content itself, including regression testing and ensuring that the firmware does not introduce issues such as BitLocker recovery loops. If a critical issue is discovered post-release, the OEM must notify Microsoft. Microsoft then has the ability to halt distribution through Windows Update, but the trigger for that action comes from the OEM’s advisory and request. In practice, both parties are involved: the OEM identifies and escalates the issue, and Microsoft enforces the withdrawal from the Windows Update service.

    Regarding your observation about Windows IoT Enterprise devices receiving the problematic BIOS update later than standard editions, the distribution schedule is controlled by Microsoft’s Windows Update service, but the targeting rules and applicability metadata are defined by the OEM. Microsoft manages the rollout cadence across different Windows editions and servicing channels, but the OEM specifies which hardware IDs and device classes the update applies to. This means that if HP marked the BIOS update as applicable to IoT Enterprise devices, Microsoft’s update infrastructure would eventually deliver it according to its staged rollout schedule.

    In short:

    The OEM (HP) authors and submits the BIOS update.

    Microsoft validates and distributes it via Windows Update.

    If a critical issue arises, the OEM is responsible for notifying Microsoft, and Microsoft is responsible for halting distribution.

    Rollout schedules across editions, including IoT Enterprise, are managed by Microsoft, but the applicability is defined by the OEM.

    This division of responsibility is consistent with Microsoft’s official documentation on Windows Update for Business and OEM driver/firmware publishing.

    I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

    HP.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-08-06T01:49:39.8033333+00:00

    The OEM is responsible for creating and securing the BIOS or firmware update itself. Microsoft’s role is in the Windows-side delivery and trust chain, not in authoring the firmware payload.

    For firmware updates delivered through Windows Update:

    1. OEM/IHV responsibility
      • The firmware update is delivered as a driver package.
      • That package must pass Windows HLK testing and be submitted to Partner Center for signing.
      • The OEM/IHV is responsible for the integrity and security of the firmware itself, including signature verification, encryption, or other protections.
      • Firmware defaults stored in device firmware are maintained by the OEM.
    2. Microsoft responsibility
      • Windows uses the signed driver package to verify integrity before handing the firmware payload to UEFI.
      • Secure Boot and some certificate updates can be applied through Windows Update.
      • Microsoft can also pause offering an update to affected devices when compatibility issues are identified.

    Based on that, the responsibility is effectively both, but in different parts of the process:

    • Approving/publishing the firmware package for Windows Update delivery: the OEM prepares and submits the update package; Microsoft provides the signing and Windows Update delivery path.
    • Authoring and validating the BIOS update itself: the OEM.
    • Withdrawing or stopping broad Windows Update offering after an issue is found: Microsoft can pause the offering, and OEMs are involved in investigation and remediation.

    For a known critical issue such as a BitLocker recovery loop:

    • The context shows that when startup failures were linked to third-party firmware on specific models, Microsoft paused the offering of the update to affected devices.
    • The same context also states that the issue could only be addressed with firmware updates provided by the device manufacturer.

    So the practical split is:

    • Microsoft can stop or pause further Windows Update distribution to prevent more devices from being affected.
    • The OEM is responsible for producing the corrected firmware update.

    For Windows IoT Enterprise scheduling:

    The context does not provide a product-specific statement about whether Windows IoT Enterprise receives OEM BIOS updates on a Microsoft-controlled schedule versus an OEM-controlled schedule. The supported facts are only that:

    • Firmware updates are packaged and signed like driver packages for Windows delivery.
    • Availability through Windows Update can differ from vendor tools because the vendor or OEM determines the availability of their updates.

    That supports only this conclusion: the OEM determines update availability, while Microsoft provides the Windows Update distribution mechanism.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.